Re: Still Empty log file

[Yonas Abebe <jonasabebe () gmail com>]

Hi Jeremy,

Waiting your suggestions?

On Sun, Jul 22, 2012 at 10:15 PM, Yonas Abebe <jonasabebe () gmail com> wrote:

> Hi james,
>
> here is barnyard2.conf
>
> thanks
>
> #-------------------------------------------------------------
> #  Barnyard2 configuration file
> #
> #  http://www.securixlive.com/barnyard2
> #
> #  Contact: dev () securixlive com
> #-------------------------------------------------------------
>
> #
> # This file contains a sample barnyard2 configuration.
> # You can take the following steps to create your own custom configuration:
> #
> #   1) Configure the variable declarations
> #   2) Setup the input plugins
> #   3) Setup the output plugins
> #
>
> # Step 1: configure the variable declarations
> #
> # in order to keep from having a commandline that uses every letter in the
> # alphabet most configuration options are set here.
>
> # use UTC for timestamps
> #
> #config utc
>
> # set the appropriate paths to the file(s) your Snort process is using.
> #
> #config reference_file:    /etc/snort/reference.config
> #config classification_file: /etc/snort/classification.config
> #config gen_file:            /etc/snort/gen-msg.map
> #config sid_file:        /etc/snort/sid-msg.map
>
> config reference_file:  /usr/local/snort/etc/reference.config
> config classification_file: /usr/local/snort/etc/classification.config
> config gen_file:                /usr/local/snort/etc/gen-msg.map
> config sid_file:               /usr/local/snort/etc/sid-msg.map
>
>
> # define dedicated references similar to that of snort.
> #
> #config reference: mybugs http://www.mybugs.com/?s=
>
> # define explicit classifications similar to that of snort.
> #
> #config classification: shortname, short description, priority
>
> # set the directory for any output logging
> #
> #config logdir: /tmp
>
> # to ensure that any plugins requiring some level of uniqueness in their
> output
> # the alert_with_interface_name, interface and hostname directives are
> provided.
> # An example of usage would be to configure them to the values of the
> associated
> # snort process whose unified files you are reading.
> #
> # Example:
> #   For a snort process as follows:
> #     snort -i eth0 -c /etc/snort.conf
> #
> #   Typical options would be:
> #     config hostname: thor
> #     config interface: eth0
> #     config alert_with_interface_name
> #
> #config hostname: thor
> #config interface: eth0
>
> config hostname: localhost
> config interface: eth0
>
> # enable printing of the interface name when alerting.
> #
> #config alert_with_interface_name
>
> # at times snort will alert on a packet within a stream and dump that
> stream to
> # the unified output. barnyard2 can generate output on each packet of that
> # stream or the first packet only.
> #
> #config alert_on_each_packet_in_stream
>
> # enable daemon mode
> #
> #config daemon
>
> # make barnyard2 process chroot to directory after initialisation.
> #
> #config chroot: /var/spool/barnyard2
>
>
> # specifiy the group or GID for barnyard2 to run as after initialisation.
> #
> #config set_gid: 999
>
> # specifiy the user or UID for barnyard2 to run as after initialisation.
> #
> #config set_uid: 999
>
> # specify the directory for the barnyard2 PID file.
> #
> #config pidpath: /var/run/by2.pid
>
> # enable decoding of the data link (or second level headers).
> #
> #config decode_data_link
>
> # dump the application data
> #
> #config dump_payload
>
> # dump the application data as chars only
> #
> #config dump_chars_only
>
> # enable verbose dumping of payload information in log style output
> plugins.
> #
> #config dump_payload_verbose
>
> # enable obfuscation of logged IP addresses.
> #
> #config obfuscate
>
> # enable the year being shown in timestamps
> #
> #config show_year
>
> # set the umask for all files created by the barnyard2 process (eg. log
> files).
> #
> #config umask: 066
>
> # enable verbose logging
> #
> #config verbose
>
> # quiet down some of the output
> #
> #config quiet
>
> # define the full waldo filepath.
> #
> #config waldo_file: /tmp/waldo
>
>
> # specificy the maximum length of the MPLS label chain
> #
> #config max_mpls_labelchain_len: 64
>
> # specify the protocol (ie ipv4, ipv6, ethernet) that is encapsulated by
> MPLS.
> #
> #config mpls_payload_type: ipv4
>
> # set the reference network or homenet which is predominantly used by the
> # log_ascii plugin.
> #
> #config reference_net: 192.168.0.0/24
>
> #
> # CONTINOUS MODE
> #
>
> # set the archive directory for use with continous mode
> #
> #config archivedir: /tmp
>
> # when in operating in continous mode, only process new records and ignore
> any
> # existing unified files
> #
> #config process_new_records_only
>
>
>
> # Step 2: setup the input plugins
> #
> # this is not hard, only unified2 is supported ;)
> input unified2
>
>
>
> # Step 3: setup the output plugins
>
> # alert_cef
> #-----------------------------
> #
> # Purpose:
> #  This output module provides the abilty to output alert information to a
> # remote network host as well as the local host using the open standard
> # Common Event Format (CEF).
> #
> # Arguments: host=hostname[:port], severity facility
> #            arguments should be comma delimited.
> #   host - specify a remote hostname or IP with optional port number
> #                 this is only specific to WIN32 (and is not yet fully
> supported)
> # severity - as defined in RFC 3164 (eg. LOG_WARN, LOG_INFO)
> # facility - as defined in RFC 3164 (eg. LOG_AUTH, LOG_LOCAL0)
> #
> # Examples:
> # output alert_cef
> # output alert_cef: host=192.168.10.1
> # output alert_cef: host=sysserver.com:1001
> # output alert_cef: LOG_AUTH LOG_INFO
> #
>
> # alert_bro
> #-----------------------------
> #
> # Purpose: Send alerts to a Bro-IDS instance.
> #
> # Arguments: hostname:port
> #
> # Examples:
> # output alert_bro: 127.0.0.1:47757
>
> # alert_fast
> #-----------------------------
> # Purpose: Converts data to an approximation of Snort's "fast alert" mode.
> #
> # Arguments: file <file>, stdout
> #            arguments should be comma delimited.
> #   file - specifiy alert file
> #   stdout - no alert file, just print to screen
> #
> # Examples:
> #   output alert_fast
> #   output alert_fast: stdout
>
> #
> #output alert_fast: stdout
>
>
> # prelude: log to the Prelude Hybrid IDS system
> # ---------------------------------------------
> #
> # Purpose:
> #  This output module provides logging to the Prelude Hybrid IDS system
> #
> # Arguments: profile=snort-profile
> #   snort-profile - name of the Prelude profile to use (default is snort).
> #
> # Snort priority to IDMEF severity mappings:
> # high < medium < low < info
> #
> # These are the default mapped from classification.config:
> # info   = 4
> # low    = 3
> # medium = 2
> # high   = anything below medium
> #
> # Examples:
> #   output alert_prelude
> #   output alert_prelude: profile=snort-profile-name
> #
>
>
> # alert_syslog
> #-----------------------------
> #
> # Purpose:
> #  This output module provides the abilty to output alert information to a
> # remote network host as well as the local host.
> #
> # Arguments: host=hostname[:port], severity facility
> #            arguments should be comma delimited.
> #   host - specify a remote hostname or IP with optional port number
> #                 this is only specific to WIN32 (and is not yet fully
> supported)
> # severity - as defined in RFC 3164 (eg. LOG_WARN, LOG_INFO)
> # facility - as defined in RFC 3164 (eg. LOG_AUTH, LOG_LOCAL0)
> #
> # Examples:
> # output alert_syslog
> # output alert_syslog: host=192.168.10.1
>
> #output alert_syslog: host=127.0.0.1
> # output alert_syslog: host=sysserver.com:1001
> # output alert_syslog: LOG_AUTH LOG_INFO
> #
>
>
> # log_ascii
> #-----------------------------
> #
> # Purpose: This output module provides the default packet logging
> funtionality
> #
> # Arguments: None.
> #
> # Examples:
> #   output log_ascii
> #
>
>
> # log_tcpdump
> # -------------------------------------------------
> #
> # Purpose
> #  This output module logs packets in binary tcpdump format
> #
> # Arguments:
> #   The only argument is the output file name.
> #
> # Examples:
> #   output log_tcpdump: tcpdump.log
> #
>
>
> # sguil
> #-----------------------------
> #
> # Purpose: This output module provides logging ability for the sguil
> interface
> # See doc/README.sguil
> #
> # Arguments: agent_port <port>, sensor_name <name>
> #            arguments should be comma delimited.
> #   agent_port - explicitly set the sguil agent listening port
> #  (default: 7736)
> #   sensor_name - explicitly set the sensor name
> #  (default: machine hostname)
> #
> # Examples:
> #   output sguil
> #   output sguil: agent_port=7000
> #   output sguil: sensor_name=argyle
> #   output sguil: agent_port=7000, sensor_name=argyle
> #
>
>
> # database: log to a variety of databases
> # ---------------------------------------
> #
> # Purpose: This output module provides logging ability to a variety of
> databases
> # See doc/README.database for additional information.
> #
> # Examples:
> #   output database: log, mysql, user=root password=test dbname=db
> host=localhost
> output database: log, mysql, user=snort password=xxxxxxxxx dbname=snort
> host=localhost
>
> #   output database: alert, postgresql, user=snort dbname=snort
> #   output database: log, odbc, user=snort dbname=snort
> #   output database: log, mssql, dbname=snort user=snort password=test
> #   output database: log, oracle, dbname=snort user=snort password=test
> #
>
>
>
> On Sun, Jul 22, 2012 at 6:41 PM, Jeremy Hoel <jthoel () gmail com> wrote:
>
> > Can you post your barnyard2 conf?
> > On Jul 22, 2012 4:10 AM, "Yonas Abebe" <jonasabebe () gmail com> wrote:
> >
> > > I started barnyard2 with the following command after starting snort.
> > >
> > > sudo /usr/local/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d
> > > /var/log/snort/ -f snort.u2 -w /var/log/snort -G
> > > /usr/local/snort/etc/gen-msg.map -S  /usr/local/snort/etc/sid-msg.map
> > >
> > > The output of the command is the following.
> > >
> > >  --== Initializing Barnyard2 ==--
> > > Initializing Input Plugins!
> > > Initializing Output Plugins!
> > > Parsing config file "/usr/local/snort/etc/barnyard2.conf"
> > > Log directory = /var/log/barnyard2
> > > database: inconsistent cid information for sid=2
> > >           Recovering by rolling forward the cid=102
> > > database: compiled support for (mysql)
> > > database: configured to use mysql
> > > database: schema version = 107
> > > database:           host = localhost
> > > database:           user = snort
> > > database:  database name = snort
> > > database:    sensor name = localhost:eth0
> > > database:      sensor id = 2
> > > database:     sensor cid = 103
> > > database:  data encoding = hex
> > > database:   detail level = full
> > > database:     ignore_bpf = no
> > > database: using the "log" facility
> > >
> > >         --== Initialization Complete ==--
> > >
> > >   ______   -*> Barnyard2 <*-
> > >  / ,,_  \  Version 2.1.9 (Build 263)
> > >  |o"  )~|  By the SecurixLive.com Team:
> > > http://www.securixlive.com/about.php
> > >  + '''' +  (C) Copyright 2008-2010 SecurixLive.
> > >
> > >            Snort by Martin Roesch & The Snort Team:
> > > http://www.snort.org/team.html
> > >            (C) Copyright 1998-2007 Sourcefire Inc., et al.
> > >
> > > Using waldo file '/var/log/snort/barnyard2.waldo':
> > >     spool directory = /var/log/snort
> > >     spool filebase  = snort.u2
> > >     time_stamp      = 1342943239
> > >     record_idx      = 6
> > > Opened spool file '/var/log/snort/snort.u2.1342943239'
> > > Closing spool file '/var/log/snort/snort.u2.1342943239'. Read 6 records
> > > Opened spool file '/var/log/snort/snort.u2.1342943594'
> > > Waiting for new data
> > >
> > >
> > > Thanks
> > >
> > >
> > >
> > >
> > >
> > >
> > > On Sun, Jul 22, 2012 at 2:13 AM, Jeremy Hoel <jthoel () gmail com> wrote:
> > >
> > > > When you start barnyard2 do you get any errors?  Does it complain about
> > > > not seeing the DB or tables?
> > > > On Jul 21, 2012 9:20 AM, "Yonas Abebe" <jonasabebe () gmail com> wrote:
> > > >
> > > > > Hi James,
> > > > >
> > > > > It works now. I can see the alerts in the snort.fast file. The u2 file
> > > > > also has contents although i couldn't see it. I was also trying to see
> > > > > whether barnyard2 has sent the alerts to mysql. I used "show tables" in
> > > > > mysql but couldn't see anything.
> > > > >
> > > > > Thanks again James
> > > > >
> > > > > On Sat, Jul 21, 2012 at 1:55 AM, Lay, James <james.lay () wincofoods com>wrote:
> > > > >
> > > > > > Yonas,****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > Config looks good…could use tuning when you can.  For a test, put
> > > > > > this into your local.rules file:****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > alert icmp any any -> any any (msg:"ICMP test";
> > > > > > classtype:bad-unknown; sid:10000016; rev:1;)****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > Then save and start up snort.  Ping to or from the machine you’re
> > > > > > running snort on, and you should see alerts things both in the u2 file, and
> > > > > > snort.fast file.  Lemme know how it goes.****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > James****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > *From:* Yonas Abebe [mailto:jonasabebe () gmail com]
> > > > > > *Sent:* Friday, July 20, 2012 1:12 PM
> > > > > >
> > > > > > *To:* Lay, James
> > > > > > *Cc:* snort-users () lists sourceforge net
> > > > > > *Subject:* Re: [Snort-users] Still Empty log file****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > Hi james,****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > Here is my snort.conf. Thanks a lot.****
> > > > > >
> > > > > > yonas****
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > ** **
> > > > > >
> > > > > > On Fri, Jul 20, 2012 at 12:29 AM, Lay, James <
> > > > > > james.lay () wincofoods com> wrote:****
> > > > > >
> > > > > > Hi Yonas,****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > Can you put in your snort.conf here?  That will help.  Also, if say
> > > > > > your HOME_NET is for example 192.168.1.0/24, and you’re
> > > > > > scanning/pinging from another IP on that same network, Snort won’t see it
> > > > > > as it’s on the same LAN.****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > James****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > *From:* Yonas Abebe [mailto:jonasabebe () gmail com]
> > > > > > *Sent:* Thursday, July 19, 2012 2:35 PM
> > > > > > *To:* Lay, James
> > > > > > *Cc:* snort-users () lists sourceforge net
> > > > > > *Subject:* Re: [Snort-users] Still Empty log file****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > Hi James,****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > I didn't put the whole path for the file name in the output lines of
> > > > > > snort.conf (my mistake). Now, the output lines look like the following:
> > > > > > ****
> > > > > >
> > > > > >   ****
> > > > > >
> > > > > > output unified2: filename /var/log/snort/snort.u2, limit 128****
> > > > > >
> > > > > > output alert_fast: /var/log/snort/snort.fast****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > Then i tried the same simple test using ping, tracert and nmap
> > > > > > attack. Now the snort.fast, barnyard2.waldo and snort.u2  contain some
> > > > > > fixed size bytes which doesn't grow although i repeated the test attack
> > > > > > many times. Is there something that I am missing?****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > I really appreciate for the help.****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > On Wed, Jul 18, 2012 at 8:16 PM, Lay, James <james.lay () wincofoods com>
> > > > > > wrote:****
> > > > > >
> > > > > > From: Yonas Abebe [mailto:jonasabebe () gmail com]
> > > > > > Sent: Monday, July 16, 2012 11:02 AM
> > > > > > To: snort-users () lists sourceforge net
> > > > > > Subject: [Snort-users] Still Empty log file****
> > > > > >
> > > > > >
> > > > > > Hi all,
> > > > > >
> > > > > > I am having problems with empty output log files. I am running Snort
> > > > > > 2.9.2.2 on Ubuntu virtual machine by following the guide at the Snort page.
> > > > > > I have barnyard2 installed to send output to Mysql....unified2 output is
> > > > > > configured on snort.conf. I started snort with a command
> > > > > >
> > > > > > sudo /usr/local/snort/bin/snort -u snort -g snort -c
> > > > > > /usr/local/snort/etc/snort.conf  -i eth0
> > > > > >
> > > > > > I started barnyard2 with the command
> > > > > >
> > > > > > sudo sudo /usr/local/bin/barnyard2 -c
> > > > > > /usr/local/snort/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w
> > > > > > /var/log/snort/barnyard2.waldo
> > > > > >
> > > > > > The output of barnyard command is OK but shows, WARNING: Ignoring
> > > > > > corrupt/truncated waldofile.
> > > > > >
> > > > > > For a simple test i did nmap attack,Snort creates the log files in
> > > > > > /var/log/snort but the size is always empty. i can see the output on the
> > > > > > console though. I have tried to research and apply almost all the advice on
> > > > > > similar issue in this mailing list but none of them helped me. Could you
> > > > > > please help me?
> > > > > >
> > > > > > thanks
> > > > > >
> > > > > >
> > > > > > ****
> > > > > >
> > > > > > Yonas,
> > > > > >
> > > > > > What are your output lines in your snort.conf?  Something like the
> > > > > > below?
> > > > > >
> > > > > > output alert_fast: /var/log/snort.fast
> > > > > > output unified2: filename /var/log/snort.u2
> > > > > >
> > > > > > If not, for testing, try adding the alert_fast to see what happens
> > > > > > there.  Also, try the command u2spewfoo on your snort.u2 file and see what
> > > > > > that shows.
> > > > > >
> > > > > > James****
> > > > > >
> > > > > >  ****
> > > > > >
> > > > > > ** **
> > > > >
> > > > >
> > > > >
> > > > > ------------------------------------------------------------------------------
> > > > > Live Security Virtual Conference
> > > > > Exclusive live event will cover all the ways today's security and
> > > > > threat landscape has changed and how IT managers can respond.
> > > > > Discussions
> > > > > will include endpoint security, mobile security and the latest in
> > > > > malware
> > > > > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > > > > _______________________________________________
> > > > > Snort-users mailing list
> > > > > Snort-users () lists sourceforge net
> > > > > Go to this URL to change user options or unsubscribe:
> > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > Snort-users list archive:
> > > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > > >
> > > > > Please visit http://blog.snort.org to stay current on all the latest
> > > > > Snort news!
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!